CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ50

VerifiedEvent Search

What data points should you expect after executing this query?

#event_simpleName=UserIdentity  
| aid=?aid LogonType=10
Explanation

aid=?aid limits results to one specified host, while LogonType=10 identifies RDP (remote interactive) logons. Filtering UserIdentity events returns the associated user details for those RDP connections.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!